search

appmattus / certificatetransparency

Certificate transparency for Android and JVM
Apache License 2.0
142 stars 29 forks source link

Detect CT check failed in client - Callbacks #107

Closed gnair03 closed 3 months ago

gnair03 commented 6 months ago

HI @mattmook I am using v1.1.1 of the CT SDK and have just upgraded to 2.4.0. We are in the process of setting up alerts (slack alerts) in case CT checks kick in and a MITM is detected by the SDK. For this, we need some callback from the SDK that can help us trigger these events. Any such callback that can be configured?

mattmook commented 3 months ago

Hi @gnair03, yes, the easiest way is through the CTLogger interface; an instance can be provided in the configuration.

                logger = object : CTLogger {
                    override fun log(host: String, result: VerificationResult) {
                        println("$host $result")
                    }
                }

VerificationResult will tell you whether the connection was Success or Failure and if Failure it will detail why the CT library rejected it. Note insecure connections (i.e. http) get logged as Success.InsecureConnection as CT checks are appropriate. Also worth looking out for Success.DisabledStaleLogList too which occurs if the library cannot update its log-list in over 70 days (assumption is majority of apps will have refreshed data unless Google take down the source of the log-list.json)